CVE-2026-119027
Received Received - Intake

Code Injection in oapi-codegen via OpenAPI Document

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119027
EUVD
EUVD-2026-112755

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oapi-codegen oapi-codegen 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in oapi-codegen versions 2.5.0 through 2.8.0. Attackers can inject malicious Go code by crafting an OpenAPI document with a manipulated servers[].x-go-name field. When the victim generates Go code from this document, the injected code executes during the build or import process, potentially leading to arbitrary code execution.

Detection Guidance

To detect this vulnerability, check the version of oapi-codegen installed on your system. Run: oapi-codegen --version. If the version is between 2.5.0 and 2.8.0, your system is vulnerable. Additionally, review any OpenAPI specifications processed by oapi-codegen for malicious x-go-name fields or other injection vectors.

Impact Analysis

If you use oapi-codegen to generate Go code from OpenAPI specifications, an attacker could craft a malicious document that injects code into your generated packages. This could lead to arbitrary code execution when you build or import the generated code, potentially compromising your development environment, CI systems, or downstream applications that rely on the generated code.

Compliance Impact

This vulnerability could lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could violate compliance requirements under GDPR, HIPAA, or other regulations that mandate protection of personal or health data, potentially leading to legal penalties or reputational damage.

Mitigation Strategies
  • Upgrade oapi-codegen to version 2.8.1 or later immediately to patch the vulnerability.
  • Avoid using untrusted OpenAPI specifications for code generation. Use local, committed specifications instead.
  • Review and audit any generated Go code for suspicious init() functions or other injected code before building or importing.
  • Restrict remote $ref references in OpenAPI documents to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119027. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart